[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51D7A736.1090400@redhat.com>
Date: Fri, 05 Jul 2013 23:12:22 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Alan Coopersmith <alan.coopersmith@...cle.com>
CC: oss-security@...ts.openwall.com, security@...e.de,
Sebastian Krahmer <krahmer@...e.de>
Subject: Re: Question about CVE for X!! DoS
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/05/2013 09:22 PM, Alan Coopersmith wrote:
> On 07/ 5/13 01:50 PM, Kurt Seifried wrote:
>> -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
>>
>> http://lists.opensuse.org/opensuse-updates/2013-07/msg00023.html
>> https://bugzilla.novell.com/show_bug.cgi?id=815583
>>
>> Lists no CVE? I assume it needs one, or did upstream handle
>> this?
>
> Upstream discussion, including reps from both Red Hat & SuSE,
> determined it didn't need a CVE, since it can only be triggered by
> a client authorized to connect to the Xserver (via xauth, xhost,
> etc.) and such a client, by design, can lock all other clients out
> from the server, kill clients, etc.
>
> It would be like wanting a CVE for the fact that another process
> running under your UID can kill your process.
>
> Not sure why SuSE decided to go ahead and release it as a security
> fix anyway - it's certainly a bug fix though.
Yeah that's what had me confused. I would classify this as security
hardening (good to fix, but no trust boundary gets crossed), not a
security vulnerability. Was wondering if it had been found to be worse
or something.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJR16c1AAoJEBYNRVNeJnmTGBwP/2uN26UIKrLsSxF7qCNaRmK0
szTvWKDq4Q2Bqm3S6lAmsNItS4Sjilx7HEEjUW52NmJysdNvJwpO9v03bYUtMLqn
8/PLVGh998BWDtby1kqZOb2VEhLDnAyfFMp3HsNjm+kwAgBv3NDgFgTI6sIhNdkA
TVHP4jSoD1rAfSJzJqpB8saLeqR1T0wF5n6jDA+0Ghkv6R+C97EMUfz6wJnjlXRi
eAXftO86GJVce4XunLxnS3hhGqTxzNlZ1nfo16UphkV36nQ5720SC+AzmnOWFsBp
6JNF42H/JdHKdXOIa6WQa/CkpyTw2INOEmgzz2Pz2qjn12vR2GE4YzvsqZuoj/H3
XGT1l8D3wj4I9CPeYOqAWC+6YgcgMU68Hx+kueiDIS7dMn+KpT/96im8ochbSM1v
ay+wFLY6m6N3JaZo+ZsXmy3Hri74TMyXyAvo2wl0cZwE21tMKHDTJWa55lEKY/xr
MdTSaKh9vhO9G7XHwAHiWI+zNwqK685HPV8JRq8kTvRa7b8hcbVem77n1zui2wJZ
fXYXL5FtyZIFqd72da7coRzWK0h3GQUVfGysMSRZ0fxkvw2gB/euLF638al/b/1x
JTsldj8LdkAFwGxGYE/iM1zFeB3bt2XOTi3g3d0XHD5j4D1hYKj8JvIYs+2d/QVe
qzs1o9U7ocA5xHfNzMqq
=9vM2
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
